lsh-bugs

lsh-bugs@lists.lysator.liu.se

491 discussions

Start a nNew thread

e10641427029847.15754166245
by lsh-list＠brennmeister.com 21 Sep '03

21 Sep '03

1 0

ANNOUNCE: lsh-1.4.3 and lsh-1.5.3
by nisse＠lysator.liu.se 20 Sep '03

20 Sep '03

All lsh versions prior to lsh-1.4.3, as well as lsh-1.5, lsh-1.5.1 and lsh-1.5.2, have a *buffer overrun* bug. This bug can lead to remote root compromise of the lshd daemon, and it can most likely also let a malicious server execute arbitrary code in the lsh client. And the affected code is run before either host or user autentication. The stable release lsh-1.4.3 and the development release lsh-1.5.3 both fix this bug, and two other bugs of similar character (but different consequences) which were found when greping the code for similar mistakes. All users of lsh and lshd should upgrade, and in case you can't upgrade lshd immediately, you are *strongly* advised to disable lshd service. Credit is due to Bennett Todd, who reported a crash which turned out to be a buffer overrun. Example exploit programs have been posted to the full-disclosure mailinglist. NEWS for lsh-1.4.3: Fixed heap buffer overrun with potential remote root compromise. Initial bug report by Bennett Todd. Fixed a similar bug in the check for channel number allocation failure in the handling of channel_open, and in the experimental client SRP code. Backported lshd setsid fix from lsh-1.5. Should call setsid both in the pty and non-pty cases. Updated the code to compile with automake-1.7.3 and scsh-0.6.0. The NEWS entry for lsh-1.5.3 is similar, but since it belongs to the development branch, it also contains some new experimental code, News for the 1.5.3 release Fixed heap buffer overrun with potential remote root compromise. Initial bug report by Bennett Todd. Fixed a similar bug in the check for channel number allocation failure in the handling of channel_open, and in the experimental client SRP code. lshd now has an experimental mode similar to telnet, where it accepts the 'none' authentication method and automatically disables services such as X and TCP forwarding. This can be useful in environment where it's required that /bin/login or some other program handle authentication and session setup (e.g. handle security contexts and so on). If you need a bug-fix-only update, you are advised to either stay with lsh-1.4.3, or apply the relevant three lines of the 1.4.3 patch, included below, to your 1.5.2 tree. The releases can be downloaded from http://www.lysator.liu.se/~nisse/archive/lsh-1.4.3.tar.gz http://www.lysator.liu.se/~nisse/archive/lsh-1.4.2-1.4.3.diff.gz http://www.lysator.liu.se/~nisse/archive/lsh-1.5.3.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-1.4.3.tar.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-1.4.2-1.4.3.diff.gz ftp://ftp.lysator.liu.se/pub/security/lsh/lsh-1.5.3.tar.gz Regards, /Niels diff -urN lsh-1.4.2/src/channel_commands.c lsh-1.4.3/src/channel_commands.c --- lsh-1.4.2/src/channel_commands.c Thu Sep 27 08:29:44 2001 +++ lsh-1.4.3/src/channel_commands.c Fri Sep 19 14:15:37 2003 @@ -57,6 +57,7 @@ make_channel_open_exception( SSH_OPEN_RESOURCE_SHORTAGE, "Allocating a local channel number failed.")); + return; } channel = NEW_CHANNEL(self, connection, index, &request); diff -urN lsh-1.4.2/src/client_keyexchange.c lsh-1.4.3/src/client_keyexchange.c --- lsh-1.4.2/src/client_keyexchange.c Wed Mar 13 17:05:28 2002 +++ lsh-1.4.3/src/client_keyexchange.c Fri Sep 19 16:37:59 2003 @@ -268,6 +268,7 @@ { lsh_string_free(salt); disconnect_kex_failed(connection, "Bye"); + return; } mpz_init(x); @@ -282,8 +283,11 @@ mpz_clear(x); if (!response) - PROTOCOL_ERROR(connection->e, - "SRP failure: Invalid public value from server."); + { + PROTOCOL_ERROR(connection->e, + "SRP failure: Invalid public value from server."); + return; + } C_WRITE_NOW(connection, response); --- lsh-1.4.2/src/read_line.c Fri Aug 4 01:51:32 2000 +++ lsh-1.4.3/src/read_line.c Fri Sep 19 14:22:29 2003 @@ -98,6 +98,8 @@ /* Too long line */ EXCEPTION_RAISE(self->e, make_protocol_exception(0, "Line too long.")); + + return available; } /* Ok, now we have a line. Copy it into the buffer. */

2 1

lshd-1.5.2 bad crash
by Bennett Todd 19 Sep '03

19 Sep '03

on Red Hat 8, I can reliably crash lshd, shutting down all active sessions and leaving a pid file around so lshd refuses to restart, by running dd if=/dev/random bs=1024 count=1|nc localhost >/dev/null a few times. Sadly, capturing the random sequence that blows down an lshd and replaying it against another one doesn't seem to kill it; different running instances require different replays of the same random to kill them. Oh well, back to bloody openssh with all its bugs and patches. Drat! -Bennett

3 8

Working exploit for lsh 1.4.2
by Andreas Bogk 19 Sep '03

19 Sep '03

Hi! Haggis posted a working exploit for 1.4.2 on full-disclosure: http://lists.netsys.com/pipermail/full-disclosure/2003-September/010489.html I suggest an immediate release of a fix, and a security advisory. Andreas -- "The Board views the endemic use of PowerPoint briefing slides instead of technical papers as an illustration of the problematic methods of technical communication at NASA." -- Official report on the Columbia shuttle disaster.

1 0

e10611434346123.38996957988
by Dennis Heuer 18 Aug '03

18 Aug '03

1 0

lsh working with gss
by Dennis Heuer 17 Aug '03

17 Aug '03

I tried lsh-gss-2003-08-16.tar.gz and it works properly for me thanks Dennis

1 0

e10610317731524.80585034937
by Dennis Heuer 17 Aug '03

17 Aug '03

1 0

got parse error as below
by Dennis Heuer 16 Aug '03

16 Aug '03

In file included from client_userauth.c:58: client_userauth.c.x:516: syntax error before "gss_name_t" client_userauth.c.x:516: warning: no semicolon at end of struct or union client_userauth.c.x:517: warning: type defaults to `int' in declaration of `ctx'client_userauth.c.x:517: warning: data definition has no type or storage class client_userauth.c.x: In function `do_client_gssapi_state_mark': client_userauth.c.x:528: dereferencing pointer to incomplete type client_userauth.c.x:529: dereferencing pointer to incomplete type client_userauth.c.x:530: dereferencing pointer to incomplete type client_userauth.c.x: At top level: client_userauth.c.x:537: sizeof applied to an incomplete type

3 4

Re: got parse error as below
by nisse＠lysator.liu.se 16 Aug '03

16 Aug '03

Dennis Heuer <dh(a)onclick.org> writes: > I appended the config.h and the Makefiles of ./ and src/. As far as > I understood the thousands of parameters everything is set correctly > but I need you to check this, really... The gss related entries of your config.h: /* Work around buggy MIT library */ /* #undef GSS_C_NT_HOSTBASED_SERVICE */ /* Define to 1 if you have the <gssapi/gssapi.h> header file. */ /* #undef HAVE_GSSAPI_GSSAPI_H */ /* Define to 1 if you have the <gssapi.h> header file. */ /* #undef HAVE_GSSAPI_H */ /* Define to 1 if you have the <gss.h> header file. */ /* #undef HAVE_GSS_H */ /* Define to 1 if you have the `gss' library (-lgss). */ #define HAVE_LIBGSS 1 /* Define if gss should be used */ /* #undef WITH_GSS */ /* Whether to use gss K5 authorization (Heimdal/MIT) */ /* #undef WITH_GSS_K5 */ which seems to imply that the configure script didn't find any of the gssapi header files. (That shouldn't break the build of course, you should just get lsh built without any gssapi support, so that's a bug in the gssapi patch). Regards, /Niels

1 0

ADV: Interested in outsourcing your tech support?
by SpeakWithaGeek.com 13 Aug '03

13 Aug '03

1 0

← Newer
1
...
41
42
43
44
45
46
47
...
50
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

lsh-bugs